3 Best APIs for Ongoing Monitoring in Nigeria

Sumsub (Summary Verification) is a comprehensive identity verification and compliance platform used by over 2,000 businesses globally to verify users, screen for AML risks, monitor transactions, and onboard corporate entities. Headquartered in London with offices across Europe and the Americas, Sumsub powers KYC (Know Your Customer), KYB (Know Your Business), AML screening, and fraud prevention through a single API and no-code workflow builder. ## What the API Does Sumsub provides a suite of verification products accessible through a unified REST API. At the core is its document verification engine, which supports over 14,000 ID document types from more than 220 countries and territories. The platform extracts data from submitted documents using OCR, validates authenticity through tamper detection and security feature analysis, and cross-references extracted data against government databases where available. Beyond document checks, Sumsub offers biometric face matching — comparing a selfie to the document photo — combined with active and passive liveness detection to prevent spoofing attacks using printed photos, videos, or 3D masks. The platform also includes Nigerian NIN slip recognition, voter card parsing, and international passport verification, making it well-suited for Nigerian developer compliance requirements. ## How Developers Use It Developers integrate Sumsub via REST API or through pre-built mobile/web SDKs for iOS, Android, React Native, and Flutter. The typical integration flow involves creating an applicant (a user object in Sumsub), generating an SDK access token, and embedding the Sumsub Web SDK or Mobile SDK to collect the user's documents and selfie. The SDK handles the camera capture, liveness instructions, and document upload entirely in-browser or in-app, and fires a webhook back to your server when verification completes. For server-side processing, key endpoints include: `POST /resources/applicants` to create an applicant, `GET /resources/applicants/{applicantId}/status` to check verification status, `GET /resources/applicants/{applicantId}/one` to retrieve full check results, and `POST /resources/applicants/{applicantId}/requiredIdDocs` to configure which document types to accept. Sumsub Studio is the platform's no-code workflow builder where teams can design custom verification journeys — choosing which checks to run (document, biometric, AML, database, etc.) in what order, with conditional branching based on risk signals, without writing additional code. ## Pricing & Fees Sumsub operates on a per-verification pricing model with monthly minimum commitments. For non-regulated use cases (e.g., marketplaces, gig economy), pricing starts at $149/month with a per-verification cost of approximately $1.35. For regulated entities (fintechs, banks, crypto exchanges), the minimum rises to $299/month with per-verification costs around $1.85. Enterprise plans with custom pricing are available for high-volume customers. Sumsub does not publicly list a free tier; however, a sandbox environment with test credentials is available to all registered developers at no cost. ## Authentication Sumsub uses a dual-token authentication system. Each API request requires an App Token (passed in the `X-App-Token` header) and a request-specific HMAC SHA-256 signature (passed in the `X-App-Access-Sig` header, generated by signing the request body + timestamp using your Secret Key). This scheme prevents replay attacks and ensures requests cannot be tampered with in transit. Developers must store the Secret Key securely and never expose it client-side. The Sumsub SDK separately uses short-lived SDK Access Tokens generated server-side to authenticate end-user sessions. ## Rate Limits Rate limits are not publicly published and vary by plan tier. Sumsub's enterprise plans are designed for high-volume throughput, and production limits are negotiated as part of the contract. Developers on standard plans should contact Sumsub support to confirm their applicable limits. The sandbox environment has its own separate limits appropriate for testing. ## Compliance & Regulations Sumsub is ISO 27001 certified and GDPR compliant. The platform supports compliance with FATF (Financial Action Task Force) recommendations for AML screening, PEP and sanctions list checks against global watchlists including OFAC, EU, UN, and UK Treasury lists. For Nigerian businesses, Sumsub's checks are compatible with CBN KYC guidelines (customer due diligence requirements), NDPR data handling requirements, and EFCC AML obligations. For crypto businesses, the platform includes a Travel Rule module supporting compliance with the FATF Travel Rule for Virtual Asset Service Providers (VASPs), enabling originator/beneficiary data transmission for transactions above regulatory thresholds. ## Challenges & Gotchas for Nigerian Developers 1. **No native BVN lookup**: Sumsub does not directly query the NIBSS BVN database. For BVN verification, you would need to combine Sumsub with a Nigerian BVN API like Mono or Okra. 2. **HMAC signing complexity**: The request signing process is more involved than a simple API key — developers must correctly generate the HMAC SHA-256 signature on every request. Using the official SDK wrappers significantly reduces integration friction. 3. **Pricing for Nigerian scale**: At $1.35–$1.85 per verification, the cost can be significant for mass-market Nigerian apps with millions of users. Factor verification costs into your unit economics early. 4. **Data residency**: Sumsub stores verification data in EU-based infrastructure by default. For NDPR compliance, confirm your data processing agreement covers Nigerian user data appropriately. 5. **Webhook reliability**: Always verify incoming webhooks using the Sumsub signature header before trusting the payload — do not skip webhook signature validation in production. ## Company Background Sumsub was founded in 2015 and is headquartered in London, United Kingdom. The company has raised over $30 million in funding and serves clients in banking, crypto, lending, insurance, and marketplace industries. Notable clients include Bitpanda, Mercuryo, and Rapyd. Sumsub has a dedicated compliance team and regularly updates its watchlist databases and ID document templates. ## Frequently Asked Questions **Q: Can I use Sumsub without a business registration in Nigeria?** A: You can sign up and start testing in sandbox mode without a Nigerian business registration. Going live and enabling billing requires a valid business entity and may require compliance documentation. **Q: Does Sumsub support NGN billing?** A: Sumsub bills in USD. Nigerian businesses will need to pay via USD card, wire transfer, or through a payment provider that supports USD billing. **Q: How long does a verification take?** A: Automated decisions are returned in under 60 seconds in most cases. Manual review (for edge cases flagged by the system) typically takes a few hours. **Q: Is there a free trial?** A: Sumsub provides a full-featured sandbox environment for testing. A paid subscription is required to go live and run real verifications.

Jumio is an enterprise-grade identity verification and fraud prevention platform used by banks, fintechs, insurers, and regulated businesses across more than 200 countries. Founded in 2010 and headquartered in Sunnyvale, California, Jumio pioneered the use of artificial intelligence and computer vision for automated ID document authentication and biometric face verification. The company processes hundreds of millions of identity verifications annually and serves clients including Coinbase, Monzo, United Airlines, and various top-tier banks. ## What the API Does Jumio's core product is its KYX Platform — an end-to-end identity orchestration layer that brings together document verification, biometric authentication, AML screening, and fraud signals into a single configurable workflow. Unlike simpler KYC APIs, the KYX Platform allows compliance teams to design multi-step verification journeys with conditional logic, retry flows, and escalation paths — all without writing additional backend code. At the document layer, Jumio supports over 1,500 ID document types globally, including Nigerian international passports, National Identity Management Commission (NIMC) NIN slips, driver's licenses, and voter cards. The platform uses AI-powered OCR to extract machine-readable data from documents, multi-factor authenticity checks to detect forgeries and tampering, and document liveness detection to reject printed or screen-captured documents. The biometric layer performs face matching between the selfie captured during onboarding and the photo on the submitted document. Active liveness detection (requiring the user to perform real-time gestures) prevents spoofing via static photos, videos, and increasingly sophisticated deepfake attacks. ## How Developers Use It Jumio is integrated via REST API or through pre-built SDKs for Web, iOS, and Android. Because Jumio is enterprise-only, the typical integration path is: (1) sign a contract and receive API credentials, (2) initialize a verification transaction on your server, (3) embed the Jumio Web SDK or Mobile SDK to collect the user's document and selfie in a guided capture experience, and (4) receive verification results via webhook when processing completes. Key API endpoints include `POST /initiate` to create a new verification session and obtain an SDK token, `GET /verifications/{transactionReference}` to retrieve detailed results including extracted data fields, authenticity scores, and individual check outcomes, and event webhooks that fire on verification completion, expiry, or manual review escalation. ## Pricing & Fees Jumio operates exclusively on custom enterprise pricing negotiated through their sales team. There are no publicly listed per-check rates. Pricing varies based on verification volume, geographic markets, product modules selected (e.g., document-only vs. document + AML), and contract length. Jumio does not offer a self-serve free tier. A sandbox environment with test credentials is provided during the sales/onboarding process for integration development and QA testing. ## Authentication Jumio uses OAuth 2.0 with the Client Credentials grant type. Developers exchange their API Key and API Secret for a short-lived bearer token via the `/oauth2/token` endpoint. This bearer token is then included as an `Authorization: Bearer {token}` header on all subsequent API requests. Tokens have a configurable expiry (default typically 30 minutes) and must be refreshed. Webhook payloads from Jumio are signed, and the signature should be verified before processing the payload. ## Rate Limits Jumio does not publish rate limit specifications. As an enterprise platform, throughput limits are negotiated per contract and scaled to the client's expected verification volume. Jumio's infrastructure is designed to handle burst verification loads (e.g., product launches, marketing campaigns) without throttling, subject to contractual terms. ## Compliance & Regulations Jumio holds ISO 27001 certification (information security), SOC 2 Type II attestation, PCI DSS compliance, and GDPR compliance. The platform supports FATF recommendations for identity verification, AMLD5/6 requirements in Europe, FinCEN guidelines in the US, and CBN KYC requirements for Nigerian financial institutions. Jumio's AML module screens against OFAC, EU, UN, UK Treasury, and other major watchlists for PEPs and sanctioned individuals. ## Challenges & Gotchas for Nigerian Developers 1. **Enterprise-only onboarding**: There is no self-serve signup. Nigerian startups must go through a sales process, which can take weeks. This makes Jumio unsuitable for developers who need to get started quickly. 2. **USD-denominated pricing**: Jumio bills in USD, and at enterprise volumes, costs can be substantial. Budget carefully based on your verification volume estimates. 3. **No native BVN integration**: Jumio does not directly query the NIBSS BVN database — for BVN verification, you need a separate Nigerian-specific API. 4. **Data residency**: Verify data residency options with Jumio during contract negotiation, particularly for NDPR compliance regarding Nigerian user biometric data. 5. **SDK hosting requirements**: The Jumio Web SDK must be served over HTTPS. Ensure your hosting environment is SSL-configured before testing. ## Company Background Jumio was founded in 2010 by Daniel Mattes and is backed by investors including Centana Growth Partners and Millennium Technology Value Partners. The company processes over 500 million verifications annually and has won multiple industry awards for fraud prevention technology. In recent years, Jumio has expanded its AI capabilities significantly, adding deepfake detection and synthetic identity fraud prevention to its core product. ## Frequently Asked Questions **Q: Can a Nigerian startup use Jumio without a US entity?** A: Yes. Jumio onboards international businesses including Nigerian companies. You will need to complete their enterprise onboarding process with valid business registration documents. **Q: How long does enterprise onboarding take?** A: Typically 2–4 weeks from initial contact to receiving live API credentials, depending on contract negotiation and compliance documentation. **Q: Does Jumio support NGN billing?** A: No. Jumio invoices in USD only. **Q: What happens if a user fails verification?** A: Jumio returns a detailed decision including the specific check that failed (e.g., document authenticity, liveness, face match). You can configure retry flows within the KYX Platform or redirect users to a manual review queue.